serpschool
Join the waitlist

Draft for legal review

Privacy policy

Draft prepared from how the site works today. Not legal advice and not final. Last updated 2026-10-16.

Who we are

serpschool is operated by Zaki SMMA Ltd, a UK-based company (company no. 16106560, registered office 4th Floor, 14 Museum Place, Cardiff, Wales, CF10 3BH). We are the responsible party under South Africa's Protection of Personal Information Act (POPIA) and the controller under UK data protection law.

Contact for privacy questions: sam@zakismma.co.za. Information Officer: Sam (account owner).

What we collect and why

  • Forms (contact, newsletter, waitlist, cohort and traineeship applications): your name, email, WhatsApp number, and what you write to us (for example your background, goals and a link to your work). We use it to reply, run the programmes, and send the newsletter if you asked for it.
  • WhatsApp: if you message us, we see your number and message. WhatsApp's own terms apply to that chat.
  • Purchases: when you buy the course, the course platform and payment provider ([COURSE_PLATFORM], [PAYMENT_PROVIDER]) process your payment details and learning progress. We do not store card numbers. We receive your name, email, order and progress data to give you access, issue invoices and handle refunds.
  • Site analytics: when switched on, Google Analytics 4 records page views and clicks (for example which buttons are used) with pseudonymous identifiers. Analytics will only load after you consent. [CONSENT_STATUS]
  • Technical data: our host (Cloudflare) processes IP addresses and request data to deliver and protect the site.

Legal basis

We rely on your consent (newsletter, analytics), what is needed to perform a contract with you (purchases, programmes), our legitimate interests (running and securing the site, answering enquiries), and legal obligations (tax and accounting records).

Who we share it with

  • Email delivery: Resend.
  • Hosting and security: Cloudflare.
  • Course delivery and payments: [COURSE_PLATFORM], [PAYMENT_PROVIDER].
  • Analytics: Google (when enabled).
  • Professional advisers, and authorities where the law requires.

We do not sell your personal information.

International transfers

We are based in the UK and our providers may process data in other countries, including the United States. We use providers with contractual safeguards for those transfers. [TRANSFER_MECHANISMS]

How long we keep it

Enquiries and applications: [RETENTION_ENQUIRIES]. Customer and invoice records: [RETENTION_FINANCIAL]. Newsletter: until you unsubscribe. Analytics: [RETENTION_ANALYTICS].

Your rights

You can ask to see, correct or delete your information, object to or restrict how we use it, withdraw consent at any time, and ask for a copy. Email us and we will respond within 1 business day.

You can also complain to South Africa's Information Regulator (inforegulator.org.za) or, in the UK, the Information Commissioner's Office (ico.org.uk).

Security

We use HTTPS, restrict who can access submissions, and choose providers with recognised security practices. No system is perfectly secure, and we will tell you and the regulator where the law requires after a breach.

Children

The site and courses are for people aged 18 and over. We do not knowingly collect information from children.

Changes

We will post changes here and update the date above.